WHAT ARE DDOS ATTACKS?
A denial of service (DoS) attack is an attempt to cause harm by making a target system, such as a website or application, inaccessible to ordinary end users. Attackers usually generate a large number of packets or requests, which ultimately overload the target system. To carry out a distributed denial of service (DDoS) attack, an attacker uses a variety of hacked or controlled sources.
Classification of DDoS attacks
When considering methods to prevent such attacks, it is useful to divide them into two groups: infrastructure-level attacks (levels 3 and 4) and application-level attacks (levels 6 and 7).

Infrastructure level attacks

Infrastructure-level attacks usually include attacks at levels 3 and 4. This is the most common type of DDoS attacks, which includes vectors such as SYN flood and other reflection attacks such as UDP flood. Such attacks are usually massive and aimed at overloading network bandwidth or application servers. However, this type of attack has certain signs, so they are easier to detect.

Application-level attacks

Application-level attacks usually include attacks at levels 6 and 7. These attacks are less common, but at the same time they are more complex. As a rule, they are not as massive as infrastructure-level attacks, but they target certain expensive parts of the application and lead to the fact that it becomes inaccessible to real users. Examples include a stream of HTTP requests to a login page, an expensive search API, or even Wordpress XML-RPC streams (also known as Wordpress Pingback attacks).

Methods of protection against DDoS attacks
Reducing the areas available for attack

One of the first methods to neutralize DDoS attacks is to minimize the size of the zone that can be attacked. This technique limits the attackers' ability to attack and provides the ability to create centralized protection. It is necessary to make sure that access to the application or resources has not been opened to ports, protocols, or applications that are not intended to interact with. Thus, minimizing the number of possible attack points allows you to focus efforts on neutralizing them. In some cases, this can be achieved by placing your computing resources behind content distribution networks (CDNs) or load balancers and limiting direct Internet traffic to certain parts of your infrastructure, such as database servers. You can also use firewalls or access control lists (ACLs) to control what traffic enters applications.

The scaling plan

The two main elements of neutralizing large-scale DDoS attacks are bandwidth (or transit potential) and server performance sufficient to absorb and neutralize attacks.

Transit potential. When designing applications, it is necessary to make sure that the hosting provider provides excessive Internet connection bandwidth that allows you to handle large amounts of traffic. Since the ultimate goal of DDoS attacks is to affect the availability of resources or applications, it is necessary to place them next not only to end users, but also with large traffic exchange nodes that will easily provide your users with access to the application even with a large volume of traffic. Working with Internet applications provides even more opportunities. In this case, you can use content distribution networks (CDNs) and intelligent DNS address translation services, which create an additional layer of network infrastructure to serve content and resolve DNS queries from locations that are often located closer to end users.

Server performance. Most DDoS attacks are massive and consume a lot of resources, so it is important to be able to quickly increase or decrease the amount of your computing resources. This can be achieved by using an excessive amount of computing resources or resources with special features, such as more productive network interfaces or improved network configuration, which allows you to support the processing of large volumes of traffic. In addition, appropriate load balancers are often used to constantly monitor and distribute loads between resources and prevent overloading of any one resource.

Information about typical and atypical traffic

Each time an increase in the volume of traffic entering the host is detected, the maximum possible amount of traffic that the host can handle without impairing its availability can be taken as a guideline. This concept is called a speed limit. More advanced security methods, respectively, have additional capabilities and can intelligently accept only traffic that is allowed by analyzing individual packets. To use such tools, it is necessary to determine the characteristics of the good traffic that the target object usually receives, and be able to compare each packet with this benchmark.

Deploying firewalls to fend off complex application-level attacks

Against attacks that attempt to exploit a vulnerability in an application, such as attempts to inject SQL code or fake cross-site requests, it is recommended to use the Web Application Firewall (WAF). In addition, due to the uniqueness of these attacks, you should be able to neutralize prohibited requests yourself, which may have certain characteristics, for example, they may be defined as different from good traffic or come from suspicious IP addresses, unexpected geographical regions, etc. In order to neutralize the attacks that are taking place, it can sometimes be useful to get the support of specialists to study the characteristics of traffic and create individual protection.